NSA, CISA and FBI say six Chinese AI companies built their models on billions of tokens pulled from Claude, GPT, Gemini and Grok

The National Security Agency, CISA, and the FBI jointly accused six China-based AI companies of running industrial-scale campaigns to extract capability from US frontier models, in a formal cybersecurity advisory -- numbered AA26-251A -- published September 8. The agencies name DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun, and Z.AI, and say the six have pulled billions of tokens across millions of exchanges from Claude, GPT, Gemini, and Grok variants since at least late 2024, "likely with Chinese government awareness." Their framing is specific: distillation, the advisory says, "is not a supplement to these companies' AI model development, but the critical core of it."

A formal advisory, after months of individual accusations

This is the first time the claim has arrived as a joint US government advisory rather than an individual accusation. Anthropic itself went first, disclosing on February 23 that DeepSeek, Moonshot, and MiniMax had run coordinated distillation campaigns against Claude through roughly 24,000 fraudulent accounts, logging more than 16 million exchanges combined. The White House escalated the claim in July, when OSTP director Michael Kratsios accused Moonshot specifically of distilling Anthropic's Fable model to build its Kimi K3 -- a claim independent researchers have publicly disputed as insufficient on its own to explain K3's capability. AA26-251A is the first document to fold Alibaba, StepFun, and Z.AI into the same allegation, and the first to carry three agencies' names rather than one company's or one official's.

What the advisory says the six companies actually did

The advisory's evidence, as described, is behavioral: query volumes running from thousands to millions of requests per targeted domain, tens of thousands of fraudulent accounts managed simultaneously through proxy networks, and usage patterns the agencies say are inconsistent with normal research or commercial API use. It makes one specific, falsifiable claim about a public number: DeepSeek's widely cited $5.6 million training-cost figure, the advisory says, is misleading because it excludes the cost of the data DeepSeek obtained through distillation. Neither DeepSeek nor the advisory has published a revised estimate of what the true figure would be.

The advisory gets more specific about Moonshot AI in particular, saying the company used outputs from US models to improve its Kimi line across software engineering, mathematics, supervised fine-tuning, and reinforcement learning -- not a single stolen capability but a general uplift applied across categories of training work, and running, per the advisory, since at least mid-2025. That specificity is new: February's Anthropic disclosure and July's White House accusation both named Moonshot but stopped short of listing which capabilities the extracted data was used to build.

The dispute is over scale, not the technique itself

The advisory is careful to concede what its own case depends on: distillation -- training a smaller or newer model on a stronger one's outputs -- is a real and legitimate research technique, one every major lab, including the American ones named as victims here, uses on its own models routinely. What the agencies say crosses a line is querying a rival's API at industrial scale, through fabricated accounts, in violation of its terms of service, specifically to extract training signal rather than to use the product as offered. China's government has rejected the advisory's claims and described distillation as normal technical and commercial practice -- a real disagreement about characterization, not one where either side disputes that distillation as a method exists or has legitimate uses.

"Distillation is not a supplement to these companies' AI model development, but the critical core of it." -- NSA, CISA, and FBI, joint advisory AA26-251A

The recommended response is also worth reading closely, because it isn't a call to block anything outright. The agencies tell American labs to implement detection for anomalous account and usage patterns, then apply "subtle" response alterations -- degrading output quality for high-confidence distillation traffic without notifying the accounts involved, and varying that degradation so it can't be measured or reverse-engineered -- alongside cross-organization intelligence sharing to correlate campaigns spread across providers. That's a defensive posture built to work invisibly, which also means it can't be verified from outside -- neither by the companies it targets, nor by an independent researcher checking whether Claude, GPT, Gemini, or Grok's answers have actually changed for anyone.

As of this advisory, the pattern from July has repeated: none of the six named companies has issued an on-the-record rebuttal beyond Beijing's general statement, and OpenAI, Anthropic, Google, and xAI -- the labs whose models the advisory says were targeted -- have not publicly detailed what, if anything, they're changing in response. The claim itself is now as official as a US government document gets short of a sanctions action or an Entity List filing. Whether it's true at the scale and specificity the advisory states remains exactly where Anthropic's February disclosure and July's White House accusation left it: asserted by the accusing side, without an independent forensic analysis of any named company's training data on the public record.